Re: udp port 500 scans

["Green, Art (MED)" <Art.Green () MED GE COM>]

Perhaps someone looking for a VPN box?  500/udp is using for ISAKMP.

Art
--
Art Green                          Voice: +1 262 317 9030
GE Medical Systems                 Pager: +1 414 515 0697
P.O. Box 414, EX 497                Dialcom: 8 * 320 9030
Milwaukee, WI 53201
--

-----Original Message-----
From: Blake Frantz [mailto:blake () MC NET]
Sent: Thursday, December 21, 2000 10:27 AM
To: INCIDENTS () SECURITYFOCUS COM
Subject: udp port 500 scans


what is this?  we have been seeing this traffic quite a bit lately.

Wed Dec 20 12:29:02 2000 x.x.x.x/500 -> y.y.y.y/500 udp
Wed Dec 20 12:29:02 2000 x.x.x.x/500 -> y.y.y.y/500 udp
Wed Dec 20 12:29:02 2000 x.x.x.x/500 -> y.y.y.y/500 udp
Wed Dec 20 12:29:02 2000 x.x.x.x/500 -> y.y.y.y/500 udp
Wed Dec 20 12:29:02 2000 x.x.x.x/500 -> y.y.y.y/500 udp
Wed Dec 20 12:29:02 2000 x.x.x.x/500 -> y.y.y.y/500 udp
Wed Dec 20 12:29:02 2000 x.x.x.x/500 -> y.y.y.y/500 udp

thanks in advance.

blake

========================================================================
"I'm sure my men can handle one little penguin." "No, Mr Gates, your men
are already dead."